chore(deps): update fallow to 3.34.0

[thymikee]

Summary

Update Fallow from 3.32.0 to 3.34.0 for the tsconfig-reference traversal fix in fallow-rs/fallow#3504 (upstream issue).

Six files: preserve recursive matching with explicit ** globs and remove outdated slowdown explanations. Keep the separate typecheck config for Freerange. Rebased onto c966724bea; removed the unrelated package ordering change Drew noted. No runtime behavior changes or scope expansion.

Validation

Current head: b9ac16fcb4a91eb1c471f6e600bebcbce33693c8.

• Blocked: fresh pnpm install --frozen-lockfile rejects all 10 Fallow entries with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION. The 24-hour policy and exclusions are unchanged. CI install evidence.
• pnpm check:affected --run --head b9ac16fcb4a91eb1c471f6e600bebcbce33693c8: refused stale installed dependencies; no checks ran (receipt run-OGjd5R, failed).
• Independent rebase review: no findings. Range-diff contains only the package-ordering revert.
• Previous head 2761c5c53d: 36 local checks passed, 15,956 unit tests passed; this does not validate the rebased head or CI installation.
• Retry after 2026-10-18 16:10 UTC (18:10 Warsaw), beyond the latest observed package cutoff. CI coverage, integration and device checks remain unverified.

[cubic-dev-ai]

No issues found across 6 files

_{You’re at about 98% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[thymikee]

The tooling change looks fine, but CI has no signal yet on 2761c5c. Every job that runs pnpm install --frozen-lockfile fails at install with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION. The cause is the 10 new fallow 3.34.0 entries starting at pnpm-lock.yaml:1158. fallow 3.34.0 and its platform and type-aware sub-packages were published on 2026-10-17 at about 15:53Z. They are still inside the 24h minimumReleaseAge window. All 15 failing checks, including Integration Tests, Lint/Typecheck/Package, Coverage, Smoke Tests and the docs gates, fail this way before any repo code runs. So none of them has tested the glob or comment edits. Main passes because it pins 3.32.0, which is old enough. The fix is to re-run CI after about 2026-10-18T15:55Z and confirm install passes. Please do not add the fallow packages to minimumReleaseAgeExclude. That would weaken the policy for a bump with no urgency. Not blocking: the move of @agent-device/testmu and the changed position of yauzl in package.json:323 look unrelated to the bump, so revert the reorder or mention it in the PR body, whichever you prefer. After the re-run, the next step before merge is to check that the fallow audit gates pass with the new globs.

[thymikee]

Addressed the package ordering comment and rebased onto c966724bea; new head is b9ac16fcb4a91eb1c471f6e600bebcbce33693c8. The range-diff shows only that ordering cleanup beyond the rebase, and independent review found no regressions.

Confirmed the CI install failure and reproduced ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION with a fresh local frozen install. No Fallow exclusions were added and the policy is unchanged. The fresh registry check reports the latest platform package timestamp as 2026-10-17 16:00:51 UTC, so the safe retry time is after 2026-10-18 16:10 UTC (18:10 Warsaw) for a margin beyond every package cutoff.

The rebased affected gate refused stale installed dependencies before running checks. I have marked this validation as blocked in the PR body and kept the previous head's evidence separate. The PR will stay draft until installation and validation can proceed. Next step after that cutoff: install, build, run the exact-head affected gate, retry failed CI, and confirm the Fallow audit and production-export checks. No policy bypass or premature CI retry is needed.

[cubic-dev-ai]

No issues found across 6 files

_{You’re at about 99% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[thymikee]

The lockfile change still stops CI, so the checks show nothing about the 3.34.0 bump yet (reviewed at b9ac16f). The earlier findings at 2761c5c about the bump's code are not an issue now: this diff changes comments and the install pin only, and I found no new problems in it.

The remaining problem is pnpm-lock.yaml. It pins @fallow-cli/*@3.34.0, published 2026-10-17 between 15:52 and 16:00 UTC. That is inside minimumReleaseAge until about 2026-10-18 16:10 UTC, so install fails the supply-chain check before any job script runs. The cause is the same as in the previous round. All 19 failing checks therefore give no signal about the bump until the window closes. Please wait until it passes and re-run CI. Do not add a minimumReleaseAgeExclude entry or lower the policy.

The failures are likely caused by this PR, since its lockfile change adds the 3.34.0 entries. I read only the Ownership and context budgets log. It fails at the lockfile check, and the other failing jobs share that install step, but I did not read their logs.

Not blocking, and you can take or leave it: the comment edits in ci.yml, tsconfig.typecheck.json and project-references.test.ts remove the claim that fallow slows down on root tsconfig references, and they change no behavior, so either show a green fallow run on 3.34.0 or revert them. Fallow 3.34.0 has not run in CI or locally, so the glob widening and those comment claims are unchecked.

No conflicts. After 2026-10-18 16:10 UTC, re-run CI and show the checks green before merge.